
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@dcprotocol/client
Advanced tools
TypeScript client for talking to a DCP vault.
Most agent developers should start with @dcprotocol/agent. Use this package when you are building a custom runtime, service, or app that needs direct vault calls.
npm install @dcprotocol/client
import { DcpClient } from '@dcprotocol/client';
const client = new DcpClient({
mode: 'local',
vaultUrl: 'http://127.0.0.1:8420',
agentName: 'my_agent',
});
const health = await client.health();
console.log(health);
Use relay mode when an agent has pairing credentials from DCP Desktop.
import { DcpClient } from '@dcprotocol/client';
const client = new DcpClient({
mode: 'relay',
relayUrl: 'wss://relay.example.com',
vaultId: 'vault_...',
serviceId: 'agent_...',
servicePrivateKey: 'base64-ed25519-private-key',
});
The vault still owns policy, approvals, wallet signing, and secret storage.
FAQs
Internal runtime client for DCP agent and vault packages
We found that @dcprotocol/client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.